FSB spies breach Slovak defense networks

Think about the router blinking in your office, or the VPN your company uses for remote access. These unglamorous boxes are the front doors of modern infrastructure. In Slovakia, Russian state-linked hackers appear to have tested those doors around systems tied to energy networks, arms production and government ministries.

Slovakia's foreign ministry confirmed the country was targeted by cyber operations linked to Russia's FSB intelligence service (Topky/TASR). The Ministry of Investments specified that the activity aimed at critical infrastructure, the arms industry and energy sectors (TA3). No power station went dark. No trains stopped. Understanding why that distinction matters is the whole point.

The burglar who ignores the television

The operation behind this, known as Turla, is not a ransomware gang looking for quick money. Run by the FSB's Centre 16 unit, it is built to enter networks silently, stay hidden and collect intelligence over months or years (CISA). Think of a burglar who ignores the television and instead photographs the fuse box, notes where the cameras are and takes impressions of every key.

The entry points are mundane. A joint advisory from CISA and the FBI describes Centre 16 actors exploiting poorly configured routers, weak network-management settings and outdated VPN gateways, the devices that sit at the boundary between an organisation and the internet (CISA AA26-194A, FBI/IC3). A VPN gateway, for instance, can act like a visitor log and a map combined: it reveals who connects, from where, and which internal systems they reach. Configuration files can expose trusted connections and paths deeper into the network (AttackIQ).

For a ministry or energy company, that means an attacker can learn where the weak points sit without tripping any alarm. On the public evidence, this was reconnaissance for leverage, not proof of imminent sabotage.

Why neighbours care

Modern European infrastructure works less like a row of separate houses and more like an apartment block with shared wiring. Slovakia and Austria share a gas transmission network and a busy Vienna–Bratislava rail corridor (Gas Connect Austria, ÖBB). Czechia shares defence data-exchange channels and border-region systems (Novinky). That does not mean those systems were breached. It explains why governments treat a Slovak intrusion as a shared vulnerability.

No neighbouring state has reported confirmed compromise from this incident. The concern is that stolen configurations, supplier credentials or knowledge of weak points help attackers plan future moves against linked systems. Austria summoned its Russian ambassador over related cyberattacks. The EU and UK imposed their first joint sanctions against Centre 16 and the Turla operation (Sabr Cyber & Tech News, formiche.net). These responses signal that governments see the threat as shared, even without proof of cross-border damage.

A building code that cannot patch a router

This is the scenario NIS2 was designed for. The directive, essentially a building code for essential digital services, requires operators of critical infrastructure to manage cyber risk, report incidents quickly and secure their supply chains (EUR-Lex). Slovakia's handling tested that logic. Media reported the government confirmed the attacks only after journalists asked questions (TA3), and opposition figures accused the government of dangerous passivity (Aktuality).

A building code can mandate fire exits and smoke detectors. It cannot stop someone from propping the door open. NIS2 can set reporting timelines and risk assessments. It cannot patch an old router or rotate a leaked VPN key.

What happened in Slovakia, on the public evidence, is not "Russia can paralyse European infrastructure." Russian-linked actors targeted systems that could help them understand, map and prepare pressure against critical services. The footholds are quiet, the access patient, the ambition long-term. The test is whether Europe treats quiet access as seriously as visible disruption.